CVE-2026-98815

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix cdev lifetime

Sashiko bot reported a potential problem for the cdev lifetime in [0]

- the code there is heavily based on the NVMe code.

Currently the NS head .open and .release file_operations methods take and

put a reference to the nvme_ns_head to ensure that this structure does not

disappear while we open fds for that cdev.

In multipath mode, when we teardown the NS head, we call nvme_cdev_del() ->

cdev_device_del() -> cdev_del(). However after cdev_del() returns, cdevs

already open will remain and their fops will still be callable. As such,

we can still reference the cdev after the nvme_ns_head reference count

drops to 0 (and is freed).

This can be shown with an application which delays between opening the cdev

and issuing the ioctl while the NS head is being torn down:

# ./ioctl_file /dev/ng1n1 &

# waiting 10 seconds ....

# ./ini_nvme_teardown.sh

[ 21.221718] nvme nvme1: Removing ctrl: NQN "nvme-

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References